Gambit Security has uncovered a large-scale financially motivated campaign leveraging autonomous AI agents to attack online retailers. The operation, detailed by Dark Web Intelligence, involves the recovery of a staging server that revealed the use of open-source AI agent harnesses — specifically Hermes, Strix, and Cairn — to deploy credit card skimmers across more than 100 compromised sites, resulting in the theft of over 600,000 payment cards.

This campaign represents a significant escalation in the use of AI-powered tools for cybercrime, as autonomous agents are now being weaponized to automate the deployment and management of web skimming infrastructure at scale. The discovery highlights growing concerns about the misuse of open-source AI frameworks for malicious purposes and underscores the evolving threat landscape facing e-commerce platforms.